mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-17 23:52:29 +00:00
4c06b392da
The SCIM update_user (PUT) and patch_user (PATCH) handlers mapped the SCIM active field unconditionally onto the role column (role = 'user' if active else 'pending'), so a routine IdP sync or a misconfigured IdP that marked a locally-provisioned admin inactive would silently strip that admin's role and could lock an instance out of its own administration. Gate both active->role assignments on user.role != 'admin' so SCIM provisioning can activate/deactivate ordinary users but never demotes an existing admin; admin role changes continue to go through the dedicated admin endpoints. SCIM already cannot promote to admin (active only maps to user/pending), so this is symmetric. Credit to @HOHK0923 for surfacing the admin-demotion footgun. Co-authored-by: HOHK0923 <118590749+HOHK0923@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| data | ||
| internal | ||
| migrations | ||
| models | ||
| retrieval | ||
| routers | ||
| socket | ||
| static | ||
| storage | ||
| tools | ||
| utils | ||
| __init__.py | ||
| alembic.ini | ||
| config.py | ||
| constants.py | ||
| env.py | ||
| functions.py | ||
| main.py | ||
| tasks.py | ||